Financial transaction anomaly detection and risk assessment method and device based on artificial intelligence

Abstract

The invention relates to the technical field of data processing, and discloses a financial transaction anomaly detection and risk assessment method and device based on artificial intelligence. The method comprises the following steps: collecting and preprocessing multi-source financial transaction related data to obtain a multi-dimensional transaction data set; performing feature engineering and abnormal mode recognition on the multi-dimensional transaction data set to obtain an abnormal transaction recognition result; based on the abnormal transaction identification result and the multi-dimensional transaction data, constructing a financial domain knowledge graph to obtain a relation network between transaction entities; performing multi-dimensional risk assessment on the relation network among the transaction entities to obtain a risk score and risk description data; based on the risk score, performing time sequence analysis and trend extrapolation on the risk description data to obtain a dynamic risk early warning signal; and performing scene simulation and multi-factor analysis on the dynamic risk early warning signal to obtain a risk management strategy suggestion. The efficiency and accuracy of financial transaction anomaly detection and risk assessment based on artificial intelligence are improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method and device for detecting anomalies and assessing risks in financial transactions based on artificial intelligence. Background Art

[0002] With the rapid development of financial markets and the continuous expansion of transaction scale, financial institutions are facing increasingly complex risk management challenges. Traditional financial transaction anomaly detection and risk assessment methods mainly rely on rule-based systems and manual review. These methods are inefficient when processing massive amounts of data and are difficult to adapt to the ever-changing financial environment and emerging fraud methods. In recent years, some financial institutions have begun to try to introduce machine learning and data mining technologies to assist risk management, but these methods are often limited to single-dimensional analysis and are difficult to fully capture complex financial risk patterns.

[0003] However, these existing technologies still have some shortcomings. First, they are usually unable to effectively integrate multi-source heterogeneous data, resulting in insufficient information utilization. Second, existing methods are not flexible enough in dealing with dynamically changing risk patterns, and it is difficult to adapt to new financial crime methods in a timely manner. Furthermore, most systems lack in-depth analysis of risk propagation paths and cannot effectively identify systemic risks. In addition, existing risk assessment results often lack interpretability, making it difficult to provide decision makers with clear risk management recommendations. Finally, these methods usually do not take into account the prediction of long-term risk trends and dynamic adjustment mechanisms, making it difficult to provide financial institutions with forward-looking risk management support. Summary of the invention

[0004] The present application provides a method and device for financial transaction anomaly detection and risk assessment based on artificial intelligence, which is used to improve the efficiency and accuracy of financial transaction anomaly detection and risk assessment based on artificial intelligence.

[0005] In the first aspect, the present application provides an artificial intelligence-based financial transaction anomaly detection and risk assessment method, which includes: collecting and preprocessing multi-source financial transaction related data to obtain a multi-dimensional transaction data set; performing feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain an abnormal transaction identification result; constructing a financial field knowledge graph based on the abnormal transaction identification result and the multi-dimensional transaction data to obtain a relationship network between transaction entities; performing a multi-dimensional risk assessment on the relationship network between the transaction entities to obtain a risk score and risk description data; based on the risk score, performing time series analysis and trend extrapolation on the risk description data to obtain a dynamic risk warning signal; performing scenario simulation and multi-factor analysis on the dynamic risk warning signal to obtain risk management strategy recommendations.

[0006] In the second aspect, the present application provides an artificial intelligence-based financial transaction anomaly detection and risk assessment device, which includes: a processing module for collecting and preprocessing multi-source financial transaction related data to obtain a multi-dimensional transaction data set; an identification module for performing feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain an abnormal transaction identification result; a construction module for constructing a financial field knowledge graph based on the abnormal transaction identification result and the multi-dimensional transaction data to obtain a relationship network between transaction entities; an evaluation module for performing multi-dimensional risk assessment on the relationship network between the transaction entities to obtain a risk score and risk description data; an analysis module for performing time series analysis and trend extrapolation on the risk description data based on the risk score to obtain a dynamic risk warning signal; a simulation module for performing scenario simulation and multi-factor analysis on the dynamic risk warning signal to obtain risk management strategy recommendations.

[0007] In the technical solution provided by the present application, the method for detecting and assessing financial transaction anomalies based on artificial intelligence obtains a multi-dimensional transaction data set by collecting and preprocessing multi-source financial transaction related data, which significantly improves the quality and availability of the data and lays a solid foundation for subsequent analysis. Feature engineering and abnormal pattern recognition are performed on the multi-dimensional transaction data set to obtain abnormal transaction recognition results, which greatly improves the detection accuracy and efficiency of abnormal transactions and effectively reduces the probability of false positives and false negatives. Based on the abnormal transaction recognition results and multi-dimensional transaction data, a knowledge graph in the financial field is constructed to obtain a relationship network between transaction entities, making complex financial transaction relationships clear and visible, which helps to deeply understand transaction patterns and risk propagation paths. Multi-dimensional risk assessment is performed on the relationship network between transaction entities to obtain risk scores and risk description data, which realizes the comprehensive quantification and accurate characterization of risks and provides a reliable basis for risk management decisions. Based on the risk score, the risk description data is subjected to time series analysis and trend extrapolation to obtain a dynamic risk warning signal, which makes the risk warning change from static to dynamic, and improves the foresight and accuracy of risk prediction. By conducting scenario simulation and multi-factor analysis on dynamic risk warning signals, risk management strategy recommendations are obtained, achieving closed-loop management from risk identification to risk response, and greatly improving the initiative and effectiveness of risk management. This method integrates a variety of advanced artificial intelligence technologies to achieve intelligent and refined financial transaction risk management, significantly improving the risk prevention and control capabilities of financial institutions. It can not only detect potential risks in a timely manner, but also predict the development trend of risks, providing strong support for financial institutions to formulate forward-looking risk management strategies. At the same time, the adaptability and scalability of this method enables it to continuously learn and optimize, adapt to the ever-changing financial environment and new risks, and thus continuously improve the stability and security of the financial system. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0009] Figure 1 This is a schematic diagram of an embodiment of a method for detecting anomalies and assessing risks of financial transactions based on artificial intelligence in an embodiment of the present application; Figure 2 This is a schematic diagram of an embodiment of an artificial intelligence-based financial transaction anomaly detection and risk assessment device in an embodiment of the present application. DETAILED DESCRIPTION

[0010] The embodiment of the present application provides a method and device for detecting anomalies and assessing risks in financial transactions based on artificial intelligence. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0011] For ease of understanding, the specific process of the embodiment of the present application is described below. Figure 1 In the embodiments of the present application, an embodiment of the method for detecting anomalies in financial transactions and assessing risks based on artificial intelligence includes: Step S101: Collect and preprocess multi-source financial transaction related data to obtain a multi-dimensional transaction data set; Step S102: Perform feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain abnormal transaction recognition results; Step S103: construct a knowledge graph in the financial field based on the abnormal transaction identification results and multi-dimensional transaction data to obtain a relationship network between transaction entities; Step S104: Perform multi-dimensional risk assessment on the relationship network between transaction entities to obtain risk scores and risk description data; Step S105: Based on the risk score, perform time series analysis and trend extrapolation on the risk description data to obtain a dynamic risk warning signal; Step S106: Perform scenario simulation and multi-factor analysis on the dynamic risk warning signal to obtain risk management strategy recommendations.

[0012] It is understandable that the execution subject of the present application can be an artificial intelligence-based financial transaction anomaly detection and risk assessment device, or a terminal or a server, which is not specifically limited here. The present application embodiment is described by taking the server as the execution subject as an example.

[0013] Specifically, multi-source financial transaction-related data are collected and preprocessed to obtain a multi-dimensional transaction data set. This includes extracting raw transaction data from the transaction system of financial institutions, performing data cleaning to remove duplications, missing values, and outliers, and then standardizing the cleaned data to unify the data format and measurement unit. Next, the standardized data is decomposed into time series, time features are extracted, and spatial clustering analysis is performed to identify geographic location correlations. At the same time, semantic analysis is performed on the transaction description text to extract keywords and topics to form semantic feature data. Finally, these processed data are integrated into multimodal transaction data, and feature vectors are constructed through feature engineering. The relationship between transaction entities is modeled in combination with graph computing algorithms to finally form a multi-dimensional transaction data set. Subsequently, feature engineering and abnormal pattern recognition are performed on the multi-dimensional transaction data set to obtain abnormal transaction identification results. This step first performs feature selection to screen out key feature subsets, and constructs high-order features through feature combination and interaction analysis. Then the features are standardized and normalized to eliminate dimensional effects, and the main influencing factors are extracted through principal component analysis. Then, an unsupervised learning algorithm is used for cluster analysis to identify data distribution patterns and match them with behavioral baseline data. Based on statistical analysis, the distribution parameters of various indicators are calculated, the anomaly detection threshold is set, and a multi-dimensional anomaly determination rule is formed. At the same time, the historical marked data is pattern-learned through deep learning algorithms, the abnormal pattern features are extracted, and they are integrated with the multi-dimensional anomaly determination rules to form a comprehensive anomaly detection strategy. Finally, this strategy is applied to the real-time transaction data for evaluation, the anomaly score is calculated and classified and marked, and the abnormal transaction identification results are obtained.

[0014] Based on the abnormal transaction identification results and multi-dimensional transaction data, a knowledge graph in the financial field is constructed to obtain the relationship network between transaction entities. This process first extracts entities, identifies key transaction entities and extracts their features, and constructs an entity type system and ontology structure. Then, the relationship type between entities is defined, and the transaction description text is semantically analyzed to extract relationship information and normalize it. Then, relationship reasoning and completion are performed to expand implicit relationships and form an initial knowledge graph. The initial knowledge graph is quality evaluated and optimized to correct inconsistent and redundant information. Finally, entities and relationships are mapped to a low-dimensional vector space to obtain a graph embedding representation. Through similarity calculation and association analysis, a relationship network between transaction entities is formed. Multi-dimensional risk assessment is performed on the relationship network between transaction entities to obtain risk scores and risk description data. This step performs topological structure analysis on the relationship network, calculates network centrality and connectivity indicators, and identifies key nodes and risk propagation paths. Then, community discovery is performed through graph algorithms to identify closely related entity groups and detect abnormal patterns. A risk assessment indicator system is constructed based on historical risk event data, entity-level risk scores are calculated, and aggregation analysis is performed to obtain multi-level risk assessment results. Through deep learning, implicit risk features are extracted, a risk description summary is generated, and converted into an easy-to-understand text form, ultimately obtaining risk scores and risk description data.

[0015] Based on the risk score, the risk description data is analyzed in time series and trend extrapolated to obtain dynamic risk warning signals. This process reconstructs the risk score and description data in time series to form a time series data set of risk indicators, and performs seasonal decomposition and trend extraction. Then, the autocorrelation test is performed through the time series analysis method to identify time dependencies and predict short-term risk trends. The anomaly detection algorithm is applied to the prediction results to identify abnormal fluctuations and mutation points, and set multi-level warning thresholds. At the same time, the machine learning algorithm is used to mine the historical risk event data, extract risk evolution characteristics, and simulate the risk development path. Based on these analyses, the risk accumulation effect at different time scales is calculated, the potential impact range is evaluated, and multi-dimensional warning signals are generated. The final dynamic risk warning signal is formed through priority sorting and aggregation analysis. Finally, the dynamic risk warning signal is simulated and analyzed by multiple factors to obtain risk management strategy recommendations. This step decomposes and extracts features of the warning signal, identifies key risk factors, and simulates the risk transmission mechanism. A variety of possible risk evolution scenarios are generated through the Monte Carlo simulation method, and cluster analysis is performed to identify typical risk scenarios. These scenarios are tested for parameter sensitivity, the impact of different factors is evaluated, and risk decomposition is performed to identify the dominant risk sources. Then, a decision tree algorithm is applied to build a risk response decision framework, generate preliminary response plans, and evaluate and sort through multi-criteria decision-making methods to select the best plan. Combined with historical risk management experience and industry best practices, implementation recommendations are formed. Finally, a feasibility analysis and cost-effectiveness evaluation of the strategy implementation plan is conducted to generate the final risk management strategy recommendations.

[0016] For example, when a financial institution implemented this method, it first extracted transaction data from its trading system for the past year, totaling 10 million records. After data cleaning, 5% of abnormal and duplicate data were removed. After standardization and feature extraction of the remaining data, a multi-dimensional transaction data set with 200 features was formed. Through feature engineering and abnormal pattern recognition, 10,000 potential abnormal transactions were identified. The knowledge graph constructed based on this data contains 500,000 entity nodes and 2 million relationship edges. After multi-dimensional risk assessment, each entity was assigned a risk score of 0-100 and a detailed risk description was generated. Time series analysis showed that a certain type of risk showed seasonal fluctuations, with the risk index rising by 20% at the end of each quarter. Through scenario simulation, it was found that if no measures were taken, this type of risk could result in a potential loss of 100 million yuan at the end of the next quarter.

[0017] In the embodiment of the present application, the artificial intelligence-based financial transaction anomaly detection and risk assessment method obtains a multi-dimensional transaction data set by collecting and preprocessing multi-source financial transaction related data, which significantly improves the quality and availability of the data and lays a solid foundation for subsequent analysis. Feature engineering and abnormal pattern recognition are performed on the multi-dimensional transaction data set to obtain abnormal transaction recognition results, which greatly improves the detection accuracy and efficiency of abnormal transactions and effectively reduces the probability of false positives and false negatives. Based on the abnormal transaction recognition results and multi-dimensional transaction data, a financial field knowledge map is constructed to obtain a relationship network between transaction entities, making complex financial transaction relationships clear and visible, which helps to deeply understand the transaction model and risk propagation path. Multi-dimensional risk assessment is performed on the relationship network between transaction entities to obtain risk scores and risk description data, which realizes the comprehensive quantification and accurate characterization of risks and provides a reliable basis for risk management decisions. Based on the risk score, the risk description data is subjected to time series analysis and trend extrapolation to obtain a dynamic risk warning signal, so that the risk warning changes from static to dynamic, improving the foresight and accuracy of risk prediction. By conducting scenario simulation and multi-factor analysis on dynamic risk warning signals, risk management strategy recommendations are obtained, achieving closed-loop management from risk identification to risk response, and greatly improving the initiative and effectiveness of risk management. This method integrates a variety of advanced artificial intelligence technologies to achieve intelligent and refined financial transaction risk management, significantly improving the risk prevention and control capabilities of financial institutions. It can not only detect potential risks in a timely manner, but also predict the development trend of risks, providing strong support for financial institutions to formulate forward-looking risk management strategies. At the same time, the adaptability and scalability of this method enables it to continuously learn and optimize, adapt to the ever-changing financial environment and new risks, and thus continuously improve the stability and security of the financial system.

[0018] In a specific embodiment, the process of executing step S101 may specifically include the following steps: (1) Extract historical transaction records from the financial institution's transaction system to obtain original transaction data, and clean the original transaction data to remove duplicates, missing values, and outliers to obtain cleaned transaction data; (2) Perform data standardization on the cleaned transaction data, unify the data format and measurement unit, obtain standardized transaction data, and perform time series decomposition on the standardized transaction data to extract time features and obtain transaction data with time features; (3) Perform spatial cluster analysis on transaction data with time characteristics to identify geographic location correlations, obtain geographic location tag data, and divide transaction data into regions based on the geographic location tag data to obtain regionalized transaction data; (4) Perform semantic analysis on the transaction description text, extract keywords and topics, obtain semantic feature data, and associate and integrate the semantic feature data with regionalized transaction data to obtain multimodal transaction data; (5) Perform feature engineering on multimodal transaction data, construct feature vectors, obtain feature vector data, and perform abnormal pattern recognition based on the feature vector data to obtain abnormal transaction recognition results; (6) Model the relationship between transaction entities through graph computing algorithms, construct a transaction relationship network, obtain relationship network data, and integrate the relationship network data with the abnormal transaction identification results to obtain a multi-dimensional transaction data set.

[0019] Specifically, data is extracted from historical transaction records in the transaction system of financial institutions to obtain original transaction data. The required historical transaction data is extracted from the core transaction system of financial institutions through database query or API interface call. The extracted data includes key fields such as transaction time, transaction amount, transaction type, and information of both parties to the transaction. Then, the original transaction data is cleaned to remove duplicates, missing values, and outliers to obtain cleaned transaction data. The data cleaning process includes deduplication, identifying and deleting identical transaction records; missing value processing, deleting or interpolating records with missing key fields; outlier processing, using statistical methods such as Z-score or interquartile range method to identify and process outliers. Subsequently, the cleaned transaction data is standardized to unify the data format and measurement unit to obtain standardized transaction data. Standardization processing includes converting transaction amounts of different monetary units into a base currency, unifying timestamps into a standard format, and encoding transaction types into a unified classification system. Standardized data is convenient for subsequent analysis and processing. Then, the standardized transaction data is decomposed into time series, and time features are extracted to obtain transaction data with time features. Time series decomposition usually includes the separation of trend, seasonality and random components, using algorithms such as STL decomposition (Seasonal and Trend decomposition using Loess). The extracted time features include transaction frequency, transaction interval, periodic pattern, etc.

[0020] Spatial clustering analysis is performed on transaction data with time characteristics to identify geographic location correlation and obtain geographic location tag data. Spatial clustering analysis uses algorithms such as DBSCAN (Density-Based Spatial Clustering of Applications with Noise) to cluster based on the geographic coordinate information of the transaction and identify transaction groups with geographic correlation. Then, the transaction data is divided into regions based on the geographic location tag data to obtain regionalized transaction data. Regional division takes into account factors such as administrative divisions and economic regions, and adds regional labels to each transaction. Semantic analysis is performed on the transaction description text to extract keywords and topics to obtain semantic feature data. Semantic analysis uses natural language processing technology, such as TF-IDF (Term Frequency-Inverse Document Frequency) algorithm to extract keywords and LDA (Latent Dirichlet Allocation) topic model to identify potential topics. The extracted semantic features reflect the content and purpose of the transaction. Subsequently, the semantic feature data is associated and integrated with the regionalized transaction data to obtain multimodal transaction data. In the association and integration process, text features are combined with structured transaction data to form a comprehensive data set containing numerical, category, time, geographic and text features.

[0021] Perform feature engineering on multimodal transaction data, construct feature vectors, and obtain feature vector data. Feature engineering includes steps such as feature selection, feature combination, and feature transformation. Feature selection uses methods such as correlation-based screening and importance-based screening to select the most representative features. Feature combination creates new composite features, such as the ratio of transaction amount to frequency. Feature transformation includes logarithmic transformation, one-hot encoding, etc., to make the features more suitable for subsequent modeling. The constructed feature vector comprehensively represents the multidimensional attributes of each transaction. Then, abnormal pattern recognition is performed based on the feature vector data to obtain abnormal transaction recognition results. Abnormal pattern recognition can use a variety of algorithms, such as isolation forest, one-class SVM, etc., to identify transactions that are significantly different from normal transaction patterns. Finally, the relationship between transaction entities is modeled through graph computing algorithms, and a transaction relationship network is constructed to obtain relationship network data. Graph computing algorithms such as PageRank or DeepWalk are used to analyze complex relationship networks between transaction entities (such as accounts and merchants) and identify key nodes and important paths. The relationship network data is fused with the abnormal transaction recognition results to obtain a multi-dimensional transaction data set. During the fusion process, network features (such as node centrality and community structure) are combined with previously obtained feature vectors and anomaly markers to form the final multi-dimensional transaction dataset.

[0022] For example, a bank applied this method to process its credit card transaction data. First, 10 million transaction records from the past 6 months were extracted from the transaction system. In the data cleaning phase, 20,000 duplicate records were deleted, 50,000 records with missing values ​​were median-filled, and 10,000 outliers (such as transactions that exceeded 10 times the credit limit) were identified and processed. Standardization converted all amounts to US dollars and unified the timestamps to UTC format. Time series decomposition found that weekend transaction volume was 30% higher than weekdays on average, and year-end transaction volume was 50% higher than usual. Spatial clustering analysis identified 100 high transaction density areas, of which 10 areas had abnormally concentrated transaction amounts. Semantic analysis extracted 500 keywords and 20 topics from transaction descriptions, such as "online shopping" and "travel consumption". Feature engineering ultimately constructed a 200-dimensional feature vector, including transaction frequency, amount change rate, merchant type, etc. Abnormal pattern recognition marked 5,000 potential abnormal transactions, accounting for 0.05% of the total. Graph computing analysis built a transaction relationship network with 1 million nodes and 5 million edges, and identified 1,000 high-risk nodes. The final multi-dimensional transaction data set includes original transaction information, spatiotemporal features, semantic features, abnormal tags, and network features.

[0023] In a specific embodiment, the process of executing step S102 may specifically include the following steps: (1) Perform feature selection on the multi-dimensional transaction data set, filter out the key feature subset, obtain the streamlined feature set, and perform feature combination and interaction analysis on the streamlined feature set to construct high-order features and obtain the enhanced feature set; (2) Perform feature standardization and normalization on the enhanced feature set to eliminate the dimension effect and obtain the normalized feature set. Perform principal component analysis on the normalized feature set to extract the main influencing factors and obtain the reduced dimension feature set. (3) Perform cluster analysis on the reduced-dimensional feature set through an unsupervised learning algorithm, identify the data distribution pattern, obtain clustering results, and match the behavioral baseline data based on the clustering results; (4) Perform statistical analysis on the behavioral baseline data, calculate the distribution parameters of various indicators, obtain statistical feature data, and set the anomaly detection threshold based on the statistical feature data to obtain multi-dimensional anomaly determination rules; (5) Use deep learning algorithms to learn patterns in historical labeled data to obtain abnormal pattern features, and then integrate the abnormal pattern features with multi-dimensional anomaly judgment rules to obtain a comprehensive anomaly detection strategy; (6) Apply a comprehensive anomaly detection strategy to evaluate real-time transaction data, calculate the anomaly score, obtain the anomaly scoring result, and classify and mark the transactions based on the anomaly scoring result to obtain the abnormal transaction identification result.

[0024] Specifically, feature selection is performed on the multi-dimensional transaction data set to screen out the key feature subsets and obtain a streamlined feature set. Feature selection uses a variety of methods, including correlation-based screening (such as Pearson correlation coefficient), importance-based screening (such as random forest feature importance), and regularization-based feature selection (such as Lasso regression). It effectively reduces the feature dimension, removes redundant and irrelevant features, and improves the efficiency and accuracy of subsequent analysis. Subsequently, feature combination and interaction analysis are performed on the streamlined feature set to construct high-order features and obtain an enhanced feature set. Feature combination includes multiplication and division operations between numerical features, combined encoding of categorical features, etc., while interaction analysis uses statistical methods to identify nonlinear relationships between features and create new interactive features. This step significantly enhances the expressive power of features and captures more complex data patterns. Next, feature standardization and normalization are performed on the enhanced feature set to eliminate the dimensionality effect and obtain a normalized feature set. Standardization converts the features into a distribution with a mean of 0 and a variance of 1, while normalization scales the feature values ​​to the [0,1] interval. These processes ensure that features of different dimensions can be compared and analyzed on the same scale. Then, principal component analysis (PCA) is performed on the normalized feature set to extract the main influencing factors and obtain the reduced dimension feature set. PCA converts the original features into a set of mutually orthogonal principal components through linear transformation, and selects the first k principal components according to the explained variance ratio of the principal components, thus achieving data dimensionality reduction and information concentration.

[0025] Subsequently, cluster analysis is performed on the reduced dimension feature set through an unsupervised learning algorithm to identify data distribution patterns and obtain clustering results. Common clustering algorithms include K-means, DBSCAN, and Gaussian mixture model (GMM). Cluster analysis groups similar transaction data into a group, which helps to discover the inherent structure and pattern of the data. Based on the clustering results, the behavioral baseline data is matched, that is, the reference standard of normal behavior is determined for each cluster. The behavioral baseline data reflects the typical characteristics and patterns of different types of transactions. The behavioral baseline data is statistically analyzed, and the distribution parameters of various indicators are calculated to obtain statistical feature data. This includes calculating statistics such as mean, standard deviation, and quantile, which comprehensively describes the statistical characteristics of various types of transactions. Based on these statistical feature data, the anomaly detection threshold is set to obtain the multi-dimensional anomaly judgment rule. The setting of the threshold is usually based on the characteristics of the statistical distribution, such as using 3 times the standard deviation or the 99% quantile as the boundary of the anomaly judgment. The multi-dimensional anomaly judgment rule takes into account the distribution characteristics of different features and can identify abnormal transactions from multiple dimensions.

[0026] At the same time, deep learning algorithms are used to learn patterns in historical labeled data to obtain abnormal pattern features. Deep learning models such as autoencoders or long short-term memory networks (LSTM) are used to learn complex abnormal patterns. These models can capture hidden patterns and temporal dependencies that are difficult to identify with traditional methods. The learned abnormal pattern features are fused with the multi-dimensional abnormality judgment rules obtained previously to obtain a comprehensive anomaly detection strategy. The fusion process may use ensemble learning methods such as random forests or gradient boosting trees to organically combine rule-based and model-based methods to improve the accuracy and robustness of anomaly detection. Finally, the comprehensive anomaly detection strategy is applied to the real-time transaction data for evaluation, and the anomaly score is calculated to obtain the anomaly scoring result. The anomaly score is usually a continuous value that reflects the degree to which the transaction deviates from the normal pattern. The transactions are classified and marked according to the anomaly scoring results to obtain the abnormal transaction identification results. The classification tags may use multi-level divisions, such as "normal", "suspicious", "high risk", etc., to facilitate subsequent risk management and processing.

[0027] For example, a bank applied this method to analyze credit card transaction data. The initial data set contained 200 features, which were reduced to 50 key features through feature selection, including transaction amount, frequency, and geographic location. Feature combinations created new features, such as the ratio of "daily transaction frequency / average frequency". Standardization converted the transaction amount into a Z score to make cards of different limits comparable. PCA analysis retained the top 20 principal components that explained 90% of the variance. K-means clustering (k=10) divided the transactions into 10 categories, such as "daily consumption" and "large-amount shopping". For the "daily consumption" category, the average transaction amount was calculated to be 100 yuan, with a standard deviation of 30 yuan. Based on this, the anomaly threshold was set to the average plus 3 times the standard deviation, that is, 190 yuan. The abnormal pattern learned by the deep learning model includes multiple small transactions in a short period of time followed by large transactions. After integrating the rules and models, the anomaly score calculated for a 500 yuan dining transaction was 0.8 (in the range of 0-1), which exceeded the threshold of 0.7 and was therefore marked as a "suspicious transaction". Using this method, the bank analyzed 10 million transactions in one month and successfully identified 5,000 potentially fraudulent transactions with an accuracy rate of 95%, significantly improving its risk management capabilities.

[0028] In a specific embodiment, the process of executing step S103 may specifically include the following steps: (1) Perform entity extraction on abnormal transaction identification results and multi-dimensional transaction data, identify key transaction subjects, obtain an entity list, and perform attribute analysis on the entity list to extract entity features and obtain entity attribute data; (2) Classify and hierarchically organize entities according to entity attribute data, build an entity type system, obtain the entity ontology structure, and define the relationship types between entities based on the entity ontology structure to obtain the relationship type template; (3) Perform semantic analysis on the transaction description text, extract the relationship information between entities, obtain initial relationship data, and normalize the initial relationship data according to the relationship type template to obtain standardized relationship data; (4) Perform relational reasoning and completion on the standardized relational data, expand implicit relations, obtain an enriched relational network, and store the enriched relational network as a graph structure to obtain the initial knowledge graph; (5) Perform quality assessment on the initial knowledge graph, identify inconsistent and redundant information, obtain a list of items to be optimized, and modify and refine the knowledge graph based on the list of items to be optimized to obtain an optimized knowledge graph; (6) Based on the optimized knowledge graph, entities and relationships are mapped to a low-dimensional vector space to obtain a graph embedding representation. Similarity calculation and association analysis are performed through the graph embedding representation to obtain the relationship network between transaction entities.

[0029] Specifically, the entity extraction is performed on the abnormal transaction identification results and multi-dimensional transaction data to identify the key transaction subjects and obtain the entity list. The entity extraction process uses named entity recognition (NER) technology to identify key entities such as individuals, companies, and banks from the transaction data. Then, the entity list is attributed and analyzed to extract entity features to obtain entity attribute data. Attribute analysis includes entity type judgment, attribute value extraction, etc. For example, for individual entities, attributes such as age, occupation, and credit score are extracted; for corporate entities, attributes such as registered capital, industry category, and establishment time are extracted. According to the entity attribute data, the entities are classified and hierarchically organized to construct an entity type system to obtain the entity ontology structure. Entity classification uses a hierarchical clustering algorithm, such as agglomerative hierarchical clustering, to classify entities with similar attributes into one category, forming a hierarchical structure such as "individual customers-high net worth customers-private banking customers". Based on the entity ontology structure, the relationship type between entities is defined to obtain a relationship type template. Relationship types include "own", "belong to", "transaction", etc. Each relationship type has its specific attributes and constraints.

[0030] Next, semantic analysis is performed on the transaction description text to extract the relationship information between entities and obtain the initial relationship data. Semantic analysis uses natural language processing techniques, such as dependency syntax analysis and semantic role labeling, to identify the relationship between entities from the text. For example, from the description of "Company A transfers 1 million yuan to individual B", it is extracted that there is a "transfer" relationship between "Company A" and "Individual B". According to the relationship type template defined above, the initial relationship data is normalized to obtain standardized relationship data. Normalization includes relationship type mapping, attribute value standardization, etc., to ensure that the extracted relationship conforms to the predefined template format. Relationship reasoning and completion are performed on the standardized relationship data to expand the implicit relationship and obtain an enriched relationship network. Relationship reasoning uses logical rules and statistical reasoning methods, such as path-based reasoning algorithms, to discover implicit relationships that are not directly expressed in the data but exist. For example, if A is a subsidiary of B and B is a subsidiary of C, it can be inferred that A is a grandson of C. Relationship completion predicts possible but unobserved relationships through methods such as matrix decomposition or knowledge graph embedding. The enriched relationship network is stored as a graph structure to obtain the initial knowledge graph. The graph structure storage uses graph database technology, such as Neo4j, to achieve efficient graph data management and query.

[0031] Subsequently, the initial knowledge graph is evaluated for quality, inconsistencies and redundant information are identified, and a list of items to be optimized is obtained. Quality evaluation includes consistency checking, completeness evaluation, and accuracy verification. Consistency checking identifies relationships that violate logical rules, such as circular dependencies; completeness evaluation finds entities or relationships with missing information; accuracy verification evaluates the correctness of information by sampling manual review or comparing with authoritative data sources. The knowledge graph is corrected and refined according to the list of items to be optimized to obtain an optimized knowledge graph. The correction process includes deleting incorrect information, supplementing missing data, adjusting the relationship structure, etc. Finally, based on the optimized knowledge graph, entities and relationships are mapped to a low-dimensional vector space to obtain a graph embedding representation. Graph embedding uses algorithms such as TransE and Node2Vec to represent nodes and edges in the graph as low-dimensional dense vectors. This representation method captures the semantic information of entities and relationships, which facilitates subsequent similarity calculation and association analysis. Similarity calculation and association analysis are performed through graph embedding representation to obtain a relationship network between transaction entities. Similarity calculation uses methods such as cosine similarity, while association analysis uses technologies such as graph neural networks to mine deep relationships between entities.

[0032] For example, a bank applied this method to analyze the inter-company transaction network. First, 100,000 entities were extracted from 1 million transaction records, including 80,000 company entities and 20,000 individual entities. 20 attributes such as registered capital, number of employees, and annual revenue were extracted for company entities, and a three-layer entity type system was constructed, such as "Company-Manufacturing-Electronic Manufacturing". 50 relationship types were defined, such as "Supplier" and "Shareholder". Through semantic analysis, 300,000 initial relationships were extracted from transaction descriptions. After normalization and relationship reasoning, the number of relationships was expanded to 500,000. The initial knowledge graph contained 100,000 nodes and 500,000 edges. The quality assessment found 5,000 items to be optimized, including 1,000 contradictory relationships and 4,000 possible missing relationships. After optimization, the knowledge graph retained 98,000 nodes and 480,000 edges. The TransE algorithm was used to embed entities and relationships into a 100-dimensional vector space. By calculating the cosine similarity of vectors, a group of 50 closely related companies were identified, with frequent capital transactions and overlapping shareholder structures between these companies. Further analysis revealed that 10 of these companies involved potential related-party transaction risks.

[0033] In a specific embodiment, the process of executing step S104 may specifically include the following steps: (1) Perform topological structure analysis on the relationship network between transaction entities, calculate network centrality and connectivity indicators, obtain network structure feature data, and identify key nodes and risk propagation paths based on the network structure feature data to obtain risk propagation data; (2) Using graph algorithms to discover communities in risk propagation data, identify closely related entity groups, obtain entity cluster structures, and perform abnormal pattern detection on entity cluster structures to identify suspicious transaction circles and obtain a list of suspicious groups; (3) Construct a risk assessment indicator system based on historical risk event data, set the weights of each indicator, obtain a risk assessment framework, and apply the risk assessment framework to the relationship network to calculate the entity-level risk score to obtain the entity risk score; (4) Aggregate and analyze entity risk scores, calculate comprehensive risk indices at the group and network levels, obtain multi-level risk assessment results, and divide thresholds based on the multi-level risk assessment results to determine risk levels and obtain graded risk markers; (5) Perform deep learning on the relationship network to extract implicit risk features and obtain a risk representation vector. The risk representation vector is then combined with the hierarchical risk marker to generate a risk description summary and obtain a structured risk description. (6) Perform natural language generation processing on the structured risk description and convert it into an understandable text form to obtain a risk description report, and integrate the risk description report with the multi-level risk assessment results to obtain risk scores and risk description data.

[0034] Specifically, the relationship network between transaction entities is topologically analyzed, and the network centrality and connectivity indicators are calculated to obtain network structure characteristic data. A variety of centrality indicators, such as degree centrality, betweenness centrality, and eigenvector centrality, are used to comprehensively evaluate the importance of nodes in the network. Connectivity indicators include average path length, clustering coefficient, etc., which are used to measure the overall structural characteristics of the network. Based on these network structure characteristic data, key nodes and risk propagation paths are identified to obtain risk propagation data. Key nodes are usually those entities with high centrality or at the hub of the network, while risk propagation paths are determined by analyzing network traffic and the connection strength between nodes. Then, community discovery is performed on risk propagation data through graph algorithms to identify closely related entity groups and obtain entity clustering structures. Community discovery algorithms such as the Louvain method or label propagation algorithm are used to divide the network into multiple closely connected subgroups. Abnormal pattern detection is performed on the entity clustering structure to identify suspicious transaction circles and obtain a list of suspicious groups. Abnormal pattern detection considers factors such as transaction patterns, capital flows, and member characteristics within the group, and uses algorithms such as Isolation Forest or Local Outlier Factor to identify abnormal groups. Subsequently, a risk assessment indicator system is constructed based on historical risk event data, and the weights of each indicator are set to obtain a risk assessment framework. The indicator system includes multiple dimensions such as transaction frequency, amount abnormality, and related party complexity. The weight setting adopts expert experience combined with data-driven methods, such as the combination of the analytic hierarchy process (AHP) and the entropy weight method. The risk assessment framework is applied to the relationship network, and the risk score at the entity level is calculated to obtain the entity risk score. The risk score of each entity is calculated based on its own characteristics and its position in the network.

[0035] Aggregate analysis is performed on entity risk scores to calculate the comprehensive risk index at the group and network levels to obtain multi-level risk assessment results. Aggregate analysis uses weighted average, maximum propagation and other methods to elevate individual risks to the group and overall network levels. Threshold division is performed based on the multi-level risk assessment results to determine the risk level and obtain graded risk markers. Threshold division can be determined based on data distribution characteristics or based on business rules. Risk levels are usually divided into multiple levels such as low, medium and high. Deep learning is performed on the relationship network to extract implicit risk features and obtain risk representation vectors. Deep learning models such as neural networks (GNNs) are used to learn network structures and node features to capture complex risk patterns. The risk representation vector is combined with the graded risk marker to generate a risk description summary and obtain a structured risk description. This step converts the numerical risk representation into an interpretable risk feature description.

[0036] Finally, the structured risk description is processed by natural language generation and converted into an understandable text form to obtain a risk description report. Natural language generation uses a combination of template filling and deep learning to generate fluent and accurate risk description text. The risk description report is integrated with the multi-level risk assessment results to obtain the final risk score and risk description data, providing a comprehensive and detailed basis for risk management decisions.

[0037] For example, a financial institution applied this method to analyze a transaction network containing 100,000 nodes (entities) and 500,000 edges (relationships). By calculating the degree centrality, it was found that on average each node was directly connected to 20 other nodes, and 100 nodes had a degree centrality of more than 100 and were identified as key nodes. The Louvain algorithm was used for community discovery, dividing the network into 1,000 communities, of which the largest community contained 1,000 nodes. Anomaly detection was performed on these communities, and 50 suspicious transaction circles were identified, whose internal transaction density was 5 times that of normal communities. The risk assessment indicator system constructed includes 20 indicators, such as transaction frequency deviation rate (weight 0.15), amount abnormality (weight 0.2), number of related parties (weight 0.1), etc. The risk score is calculated for each entity, ranging from 0 to 100. After aggregation analysis, it was found that 10% of the communities had an average risk score of more than 80 and were marked as high-risk groups. The deep learning model GCN (graph convolutional network) is used to extract risk features, representing each node as a 100-dimensional vector. Based on these vectors and risk markers, a structured risk description is generated, such as "This entity frequently trades with three high-risk groups, and the monthly transaction amount has increased abnormally by 200%."

[0038] The natural language generation module converts structured descriptions into report text, such as "Warning: Entity A has highly suspicious transaction behavior. It has recently frequently interacted with multiple high-risk groups, and its monthly transaction volume has increased significantly compared to usual. It is recommended to immediately conduct a detailed investigation and consider taking temporary restrictive measures." In the end, the method successfully identified a large-scale money laundering network involving 200 entities. The fund flow patterns between these entities were highly abnormal and highly consistent with the characteristics of many financial cases in history. This discovery prompted the regulatory authorities to launch an in-depth investigation, effectively preventing potential huge economic losses.

[0039] In a specific embodiment, the process of executing step S105 may specifically include the following steps: (1) Reconstruct the time series of risk score and risk description data to form a time series data set of risk indicators, obtain the risk time series, and perform seasonal decomposition and trend extraction on the risk time series to identify periodic patterns and obtain risk trend components; (2) Use time series analysis methods to test the autocorrelation of risk trend components, identify time dependence, obtain risk autocorrelation characteristics, and make short-term risk trend forecasts based on risk autocorrelation characteristics to obtain risk trend forecast results; (3) Apply anomaly detection algorithms to the risk trend prediction results to identify abnormal fluctuations and mutation points, obtain risk fluctuation characteristics, and set multi-level warning thresholds based on risk fluctuation characteristics, build dynamic warning rules, and obtain warning trigger conditions; (4) Use machine learning algorithms to mine patterns in historical risk event data, extract risk evolution characteristics, obtain risk evolution data, and apply the risk evolution data to the current risk status, simulate the risk development path, and obtain risk evolution predictions; (5) Based on the risk evolution prediction, calculate the risk accumulation effect at different time scales, evaluate the potential impact range, obtain the risk diffusion assessment results, and combine the risk diffusion assessment results with the warning trigger conditions to generate multi-dimensional warning signals and obtain the initial warning indicators; (6) Prioritize and aggregate the initial warning indicators, screen the key warning factors, obtain a streamlined warning indicator set, and convert the streamlined warning indicator set into visual warning information to obtain dynamic risk warning signals.

[0040] Specifically, the risk score and risk description data are reconstructed in time series to form a time series data set of risk indicators and obtain a risk time series series. It involves arranging the discrete risk assessment results in chronological order to form continuous time series data. Subsequently, the risk time series is seasonally decomposed and trend extracted to identify periodic patterns and obtain risk trend components. Seasonal decomposition uses the STL (Seasonal and Trend decomposition using Loess) method to decompose the time series into three components: trend, seasonality, and residual, thereby identifying the long-term trend and periodic fluctuations of risk changes. Then, the risk trend component is tested for autocorrelation by time series analysis to identify time dependencies and obtain risk autocorrelation characteristics. The autocorrelation test uses ACF (autocorrelation function) and PACF (partial autocorrelation function) analysis to determine the lagged dependencies of the time series. Short-term risk trend prediction is performed based on the risk autocorrelation characteristics to obtain risk trend prediction results. The prediction method can use the ARIMA (autoregressive integrated moving average) model or more complex machine learning algorithms such as LSTM (long short-term memory network).

[0041] Anomaly detection algorithms are applied to the risk trend prediction results to identify abnormal fluctuations and mutation points and obtain risk fluctuation characteristics. Anomaly detection algorithms include statistical methods (such as the Z-score method) and machine learning methods (such as the isolation forest algorithm). Multi-level warning thresholds are set according to the risk fluctuation characteristics, dynamic warning rules are constructed, and warning trigger conditions are obtained. The setting of warning thresholds takes into account factors such as historical data distribution, risk tolerance, and regulatory requirements, and is usually divided into multiple levels, such as low risk, medium risk, and high risk. Subsequently, machine learning algorithms are used to mine patterns on historical risk event data, extract risk evolution characteristics, and obtain risk evolution data. This step can use algorithms such as decision trees and random forests to identify key factors and evolution paths that lead to increased risks. Apply risk evolution data to the current risk state, simulate the risk development path, and obtain risk evolution predictions. The simulation process can use the Monte Carlo method to generate a variety of possible risk evolution scenarios.

[0042] Based on the risk evolution prediction, the risk accumulation effect at different time scales is calculated, the potential impact scope is evaluated, and the risk diffusion assessment results are obtained. The calculation of the risk accumulation effect takes into account factors such as the speed of risk transmission, impact depth and duration. The risk diffusion assessment results are combined with the warning trigger conditions to generate multi-dimensional warning signals and obtain initial warning indicators. The multi-dimensional warning signals include risk level, impact scope, duration and other aspects.

[0043] Finally, the initial warning indicators are prioritized and aggregated, and key warning factors are screened to obtain a streamlined warning indicator set. Priority sorting can be based on factors such as risk impact and urgency, using methods such as AHP (Analytic Hierarchy Process). The streamlined warning indicator set is converted into visual warning information to obtain dynamic risk warning signals. Visualization methods include dashboards, heat maps, etc., which intuitively display risk status and change trends.

[0044] For example, a financial institution applies this method to analyze the risk status of its credit card business. First, a time series is constructed from the daily risk score data of the past three years, with a total of 1095 data points. Through STL decomposition, it is found that there is an obvious seasonal pattern in the risk score, and the risk level increases by about 20% at the end of each year (November to December). Autocorrelation analysis shows that the risk score is highly correlated with the data of the previous 7 days (correlation coefficient is greater than 0.8). Based on this, the ARIMA (7,1,1) model is used for short-term prediction, and the prediction accuracy reaches 90%. Anomaly detection identifies 10 risk mutation points, among which the most significant one is that the risk score increased by 50% within 3 days. Based on this, three levels of warning thresholds are set: low risk (score less than 50), medium risk (score 50-80), and high risk (score greater than 80). Historical data analysis finds that credit card risk events are significantly correlated with economic downturns and rising unemployment rates. Incorporating these factors into the risk evolution model, it is predicted that there is a 25% probability of large-scale credit card fraud in the next 6 months.

[0045] The risk diffusion assessment shows that if a high-risk event occurs, it may affect 20% of credit card users within a week, with potential losses of up to 100 million yuan. Based on these analyses, initial warning indicators were generated, including 10 dimensions such as risk score, impact range, and development speed. After priority sorting, 5 key indicators were selected: current risk score, 7-day change rate, predicted highest score within 14 days, number of potentially affected users, and estimated loss amount. The final generated dynamic risk warning signal is presented in the form of a dashboard, showing that the current risk score is 75 (medium risk), an increase of 15% in 7 days, and a predicted maximum of 85 (high risk) within 14 days, potentially affecting 300,000 users, with an estimated loss of 20 million yuan.

[0046] In a specific embodiment, the process of executing step S106 may specifically include the following steps: (1) Decompose and extract features of dynamic risk warning signals, identify key risk factors, obtain a risk factor set, and simulate the risk transmission mechanism based on the risk factor set to obtain a risk transmission map; (2) Using the Monte Carlo simulation method, randomly perturb the key nodes in the risk transmission map to generate a variety of possible risk evolution scenarios, obtain a scenario sample set, and perform cluster analysis on the scenario sample set to identify typical risk scenarios and obtain representative scenario plans; (3) Conduct parameter sensitivity tests on representative scenario plans, evaluate the impact of different factors, obtain factor impact weights, and perform risk decomposition based on factor impact weights to identify the dominant risk sources and obtain risk tracing results; (4) Apply the decision tree algorithm to the risk tracing results, build a risk response decision framework, generate preliminary response plans, obtain a candidate strategy set, and evaluate and sort the candidate strategy set through a multi-criteria decision-making method to screen the optimal plan and obtain the optimal strategy plan; (5) Based on historical risk management experience and industry best practices, build a risk management knowledge base, extract common management principles, obtain risk management guidelines, and combine the risk management guidelines with the preferred strategy solutions to form implementation recommendations and obtain strategy implementation plans; (6) Conduct feasibility analysis and cost-benefit evaluation on the strategy implementation plan, evaluate the implementation effect, obtain a strategy evaluation report, and optimize and adjust the management strategy based on the strategy evaluation report to generate risk management strategy recommendations.

[0047] Specifically, the dynamic risk warning signals are decomposed and feature extracted to identify key risk factors and obtain a risk factor set. This involves using statistical methods such as principal component analysis (PCA) or factor analysis to extract core risk drivers from complex warning signals. Subsequently, the risk transmission mechanism is simulated based on the risk factor set to obtain a risk transmission map. The risk transmission map is a directed graph structure in which nodes represent different risk factors, edges represent the influence relationship between risk factors, and weights reflect the intensity of influence. Next, the key nodes in the risk transmission map are randomly perturbed by the Monte Carlo simulation method to generate a variety of possible risk evolution scenarios and obtain a scenario sample set. Monte Carlo simulation simulates different value combinations of risk factors through multiple random samplings, thereby generating a large number of possible risk scenarios. Cluster analysis is performed on the scenario sample set to identify typical risk scenarios and obtain representative scenario solutions. Cluster analysis uses K-means or hierarchical clustering algorithms to classify similar risk scenarios into one category, and the center point of each category is used as a representative scenario.

[0048] Subsequently, parameter sensitivity tests are conducted on representative scenario plans to evaluate the impact of different factors and obtain factor impact weights. Sensitivity tests quantify the importance of each factor by changing the value of a single factor and observing the impact on the overall risk. Risk decomposition is performed based on the factor impact weights to identify the dominant risk sources and obtain risk tracing results. The risk tracing process uses causal analysis methods, such as Bayesian networks, to trace the root causes and propagation paths of risks. Decision tree algorithms are applied to the risk tracing results to build a risk response decision framework, generate preliminary response plans, and obtain a candidate strategy set. Decision tree algorithms such as C4.5 or random forests build a multi-level decision structure based on historical risk response experience to provide corresponding response strategies for different risk situations. The candidate strategy set is evaluated and ranked by multi-criteria decision-making methods, the optimal solution is screened, and the preferred strategy solution is obtained. Multi-criteria decision-making methods such as the analytic hierarchy process (AHP) or TOPSIS comprehensively consider multiple dimensions such as cost, effect, and feasibility to comprehensively score and rank strategies.

[0049] Based on historical risk management experience and industry best practices, a risk management knowledge base is constructed to extract common management principles and obtain risk management guidelines. The construction of the knowledge base involves text mining and knowledge graph technology, which extracts key risk management principles from a large number of historical cases and industry reports. Risk management guidelines are combined with the preferred strategy plan to form implementation recommendations and obtain a strategy implementation plan. This step combines theoretical guidance with actual strategies to ensure the comprehensiveness and operability of the strategy. Finally, a feasibility analysis and cost-effectiveness evaluation are conducted on the strategy implementation plan to evaluate the implementation effect and obtain a strategy evaluation report. The feasibility analysis considers multiple aspects such as technology, resources, and regulations, while the cost-effectiveness evaluation quantifies the input-output ratio of strategy implementation. According to the strategy evaluation report, the management strategy is optimized and adjusted to generate risk management strategy recommendations. It is iterative, and the risk management strategy is continuously improved through continuous feedback and adjustment.

[0050] For example, a large commercial bank applied this method to analyze the fraud risk of its credit card business. First, 10 key risk factors were extracted from 50 initial risk indicators through PCA analysis, including transaction frequency anomaly, amount volatility, and geographical dispersion. The constructed risk transmission map shows that transaction frequency anomaly has the greatest impact on the overall risk, followed by amount volatility. 10,000 risk scenarios were generated using the Monte Carlo method, and 5 typical risk scenarios were obtained through K-means clustering (k=5). The most serious scenario shows that when the transaction frequency anomaly increases by 50% and the amount volatility increases by 30%, the overall fraud risk increases by 200%. Sensitivity analysis shows that the impact weight of transaction frequency anomaly is 0.4, the amount volatility is 0.3, the geographical dispersion is 0.2, and other factors account for 0.1.

[0051] The decision tree analysis generated 20 candidate response strategies, including adjusting transaction limits, adding identity verification steps, and optimizing risk control models. After evaluation through the AHP method, the top three strategies were selected: 1) implementing dynamic transaction limits; 2) introducing behavioral biometrics; and 3) upgrading real-time risk control models. In combination with industry best practices, a detailed implementation plan was developed, including a technical transformation path, a staff training plan, and regulatory compliance measures. A cost-benefit analysis showed that the implementation of these three strategies was expected to reduce fraud losses by 60% within 6 months, with a return on investment of 300%. Based on these analyses, the bank decided to immediately start the development of a dynamic transaction limit system and complete the pilot of behavioral biometrics within three months. This decision enabled the bank to successfully prevent potential fraud transactions worth 500 million yuan in the following year, and the fraud loss rate dropped from 0.1% to 0.03%, significantly improving risk management capabilities and customer satisfaction.

[0052] The above describes the method for detecting anomalies and risk assessment of financial transactions based on artificial intelligence in the embodiment of the present application. The following describes the device for detecting anomalies and risk assessment of financial transactions based on artificial intelligence in the embodiment of the present application. Figure 2 In the embodiment of the present application, an embodiment of the financial transaction anomaly detection and risk assessment device based on artificial intelligence includes: Processing module 201, used to collect and pre-process multi-source financial transaction related data to obtain a multi-dimensional transaction data set; An identification module 202 is used to perform feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain abnormal transaction recognition results; A construction module 203 is used to construct a financial field knowledge graph based on the abnormal transaction identification result and the multi-dimensional transaction data to obtain a relationship network between transaction entities; An evaluation module 204 is used to perform a multi-dimensional risk evaluation on the relationship network between the transaction entities to obtain risk scores and risk description data; An analysis module 205 is used to perform time series analysis and trend extrapolation on the risk description data based on the risk score to obtain a dynamic risk warning signal; The simulation module 206 is used to perform scenario simulation and multi-factor analysis on the dynamic risk warning signal to obtain risk management strategy recommendations.

[0053] Through the collaborative cooperation of the above components, the artificial intelligence-based financial transaction anomaly detection and risk assessment method obtains a multi-dimensional transaction data set by collecting and preprocessing multi-source financial transaction related data, significantly improving the quality and availability of the data and laying a solid foundation for subsequent analysis. Feature engineering and abnormal pattern recognition are performed on the multi-dimensional transaction data set to obtain abnormal transaction recognition results, which greatly improves the detection accuracy and efficiency of abnormal transactions and effectively reduces the probability of false positives and false negatives. Based on the abnormal transaction recognition results and multi-dimensional transaction data, a financial field knowledge graph is constructed to obtain the relationship network between transaction entities, making the complex financial transaction relationship clear and visible, which helps to deeply understand the transaction model and risk propagation path. Multi-dimensional risk assessment is performed on the relationship network between transaction entities to obtain risk scores and risk description data, realizing the comprehensive quantification and accurate characterization of risks, and providing a reliable basis for risk management decisions. Based on the risk score, the risk description data is subjected to time series analysis and trend extrapolation to obtain dynamic risk warning signals, which transforms the risk warning from static to dynamic, and improves the foresight and accuracy of risk prediction. By conducting scenario simulation and multi-factor analysis on dynamic risk warning signals, risk management strategy recommendations are obtained, achieving closed-loop management from risk identification to risk response, and greatly improving the initiative and effectiveness of risk management. This method integrates a variety of advanced artificial intelligence technologies to achieve intelligent and refined financial transaction risk management, significantly improving the risk prevention and control capabilities of financial institutions. It can not only detect potential risks in a timely manner, but also predict the development trend of risks, providing strong support for financial institutions to formulate forward-looking risk management strategies. At the same time, the adaptability and scalability of this method enables it to continuously learn and optimize, adapt to the ever-changing financial environment and new risks, and thus continuously improve the stability and security of the financial system.

[0054] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An artificial intelligence-based financial transaction anomaly detection and risk assessment method, characterized in that: The artificial intelligence-based financial transaction anomaly detection and risk assessment method includes: Collect and preprocess multi-source financial transaction-related data to obtain a multi-dimensional transaction data set; Performing feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain abnormal transaction recognition results; Based on the abnormal transaction identification results and the multi-dimensional transaction data, a knowledge graph in the financial field is constructed to obtain a relationship network between transaction entities; Conduct multi-dimensional risk assessment on the relationship network between the transaction entities to obtain risk scores and risk description data; Based on the risk score, time series analysis and trend extrapolation are performed on the risk description data to obtain a dynamic risk warning signal; Conduct scenario simulation and multi-factor analysis on the dynamic risk warning signals to obtain risk management strategy recommendations.

2. The method for detecting anomalies and assessing risks of financial transactions based on artificial intelligence according to claim 1, characterized in that: The multi-source financial transaction related data is collected and preprocessed to obtain a multi-dimensional transaction data set, including: Extracting historical transaction records from the financial institution's transaction system to obtain original transaction data, and cleaning the original transaction data to remove duplicates, missing values, and outliers to obtain cleaned transaction data; Performing data standardization processing on the cleaned transaction data, unifying the data format and measurement unit, obtaining standardized transaction data, and performing time series decomposition on the standardized transaction data, extracting time features, and obtaining transaction data with time features; Performing spatial cluster analysis on the transaction data with time characteristics to identify geographic location correlations, obtain geographic location tag data, and divide the transaction data into regions based on the geographic location tag data to obtain regionalized transaction data; Performing semantic analysis on the transaction description text, extracting keywords and themes, obtaining semantic feature data, and associating and integrating the semantic feature data with the regionalized transaction data to obtain multimodal transaction data; Performing feature engineering processing on the multimodal transaction data, constructing feature vectors, obtaining feature vector data, and performing abnormal pattern recognition based on the feature vector data to obtain abnormal transaction recognition results; The relationship between transaction entities is modeled through a graph computing algorithm, a transaction relationship network is constructed, relationship network data is obtained, and the relationship network data is integrated with the abnormal transaction identification result to obtain a multi-dimensional transaction data set.

3. The method for detecting anomalies and assessing risks of financial transactions based on artificial intelligence according to claim 1, characterized in that: The performing feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain abnormal transaction recognition results includes: Performing feature selection on the multi-dimensional transaction data set to screen out a key feature subset to obtain a streamlined feature set, and performing feature combination and interaction analysis on the streamlined feature set to construct high-order features to obtain an enhanced feature set; Performing feature standardization and normalization processing on the enhanced feature set to eliminate the dimension effect to obtain a normalized feature set, and performing principal component analysis on the normalized feature set to extract the main influencing factors to obtain a reduced dimension feature set; Performing cluster analysis on the reduced dimension feature set through an unsupervised learning algorithm to identify data distribution patterns, obtain clustering results, and match behavioral baseline data according to the clustering results; Performing statistical analysis on the behavioral baseline data, calculating distribution parameters of various indicators to obtain statistical feature data, and setting anomaly detection thresholds according to the statistical feature data to obtain multi-dimensional anomaly determination rules; Performing pattern learning on historical tag data through a deep learning algorithm to obtain abnormal pattern features, and fusing the abnormal pattern features with the multi-dimensional abnormality determination rules to obtain a comprehensive abnormality detection strategy; The comprehensive anomaly detection strategy is applied to the real-time transaction data to evaluate, calculate the anomaly score, obtain the anomaly scoring result, and classify and mark the transactions according to the anomaly scoring result to obtain the abnormal transaction identification result.

4. The method for detecting anomalies and assessing risks of financial transactions based on artificial intelligence according to claim 1, characterized in that: The step of constructing a financial domain knowledge graph based on the abnormal transaction identification result and the multi-dimensional transaction data to obtain a relationship network between transaction entities includes: Performing entity extraction on the abnormal transaction identification result and the multi-dimensional transaction data, identifying key transaction subjects, obtaining an entity list, and performing attribute analysis on the entity list, extracting entity features, and obtaining entity attribute data; According to the entity attribute data, entities are classified and hierarchically organized to construct an entity type system to obtain an entity ontology structure, and based on the entity ontology structure, relationship types between entities are defined to obtain a relationship type template; Performing semantic analysis on the transaction description text, extracting the relationship information between entities, obtaining initial relationship data, and normalizing the initial relationship data according to the relationship type template to obtain standardized relationship data; Performing relational reasoning and completion on the standardized relational data, expanding implicit relations, obtaining an enriched relational network, and storing the enriched relational network as a graph structure to obtain an initial knowledge graph; Performing a quality assessment on the initial knowledge graph, identifying inconsistent and redundant information, obtaining a list of items to be optimized, and correcting and refining the knowledge graph according to the list of items to be optimized to obtain an optimized knowledge graph; Based on the optimized knowledge graph, entities and relationships are mapped to a low-dimensional vector space to obtain a graph embedding representation, and similarity calculation and association analysis are performed through the graph embedding representation to obtain a relationship network between transaction entities.

5. The method for detecting anomalies and assessing risks of financial transactions based on artificial intelligence according to claim 1, characterized in that: The multi-dimensional risk assessment of the relationship network between the transaction entities is performed to obtain risk scores and risk description data, including: Performing a topological structure analysis on the relationship network between the transaction entities, calculating the network centrality and connectivity indexes, obtaining network structure feature data, and identifying key nodes and risk propagation paths based on the network structure feature data to obtain risk propagation data; Performing community discovery on the risk propagation data through a graph algorithm, identifying closely related entity groups, obtaining an entity clustering structure, and performing abnormal pattern detection on the entity clustering structure, identifying suspicious transaction circles, and obtaining a list of suspicious groups; Constructing a risk assessment indicator system based on historical risk event data, setting weights for various indicators, obtaining a risk assessment framework, and applying the risk assessment framework to the relationship network to calculate entity-level risk scores to obtain entity risk scores; Performing aggregate analysis on the entity risk scores, calculating the comprehensive risk index at the group and network levels, obtaining a multi-level risk assessment result, and performing threshold division based on the multi-level risk assessment result, determining the risk level, and obtaining a graded risk mark; Performing deep learning on the relationship network to extract implicit risk features to obtain a risk characterization vector, and combining the risk characterization vector with the hierarchical risk marker to generate a risk description summary to obtain a structured risk description; The structured risk description is processed by natural language generation and converted into an understandable text form to obtain a risk description report, and the risk description report is integrated with the multi-level risk assessment results to obtain a risk score and risk description data.

6. The method for detecting anomalies and assessing risks of financial transactions based on artificial intelligence according to claim 1, characterized in that: Based on the risk score, the risk description data is subjected to time series analysis and trend extrapolation to obtain a dynamic risk warning signal, including: Reconstructing the risk score and risk description data into time series to form a time series data set of risk indicators, obtaining a risk time series sequence, and performing seasonal decomposition and trend extraction on the risk time series sequence to identify periodic patterns and obtain a risk trend component; Performing an autocorrelation test on the risk trend component through a time series analysis method, identifying the time dependency, obtaining risk autocorrelation characteristics, and performing short-term risk trend prediction based on the risk autocorrelation characteristics to obtain a risk trend prediction result; Applying an anomaly detection algorithm to the risk trend prediction results to identify abnormal fluctuations and mutation points, obtain risk fluctuation characteristics, and set multi-level warning thresholds according to the risk fluctuation characteristics, construct dynamic warning rules, and obtain warning trigger conditions; Use machine learning algorithms to mine patterns in historical risk event data, extract risk evolution characteristics, obtain risk evolution data, and apply the risk evolution data to the current risk status, simulate the risk development path, and obtain risk evolution predictions; Based on the risk evolution prediction, the risk accumulation effect at different time scales is calculated, the potential impact range is evaluated, and the risk diffusion evaluation result is obtained. The risk diffusion evaluation result is combined with the warning trigger condition to generate a multi-dimensional warning signal and obtain an initial warning indicator; The initial warning indicators are prioritized and aggregated for analysis, key warning factors are screened, a simplified warning indicator set is obtained, and the simplified warning indicator set is converted into visual warning information to obtain a dynamic risk warning signal.

7. The method for detecting anomalies and assessing risks of financial transactions based on artificial intelligence according to claim 1, characterized in that: The scenario simulation and multi-factor analysis of the dynamic risk warning signal are performed to obtain risk management strategy suggestions, including: Decomposing and feature extracting the dynamic risk warning signal, identifying key risk factors, obtaining a risk factor set, and simulating a risk transmission mechanism based on the risk factor set to obtain a risk transmission map; By using the Monte Carlo simulation method, the key nodes in the risk conduction map are randomly disturbed to generate a variety of possible risk evolution scenarios, obtain a scenario sample set, and cluster analysis is performed on the scenario sample set to identify typical risk scenarios and obtain representative scenario solutions; Conduct parameter sensitivity tests on the representative scenario plans, evaluate the impact of different factors, obtain factor impact weights, and perform risk decomposition based on the factor impact weights to identify the dominant risk sources and obtain risk tracing results; Applying a decision tree algorithm to the risk tracing results, constructing a risk response decision framework, generating a preliminary response plan, obtaining a candidate strategy set, and evaluating and ranking the candidate strategy set through a multi-criteria decision-making method, screening the optimal plan, and obtaining an optimal strategy plan; Based on historical risk management experience and industry best practices, a risk management knowledge base is constructed to extract common management principles and obtain risk management guidelines. The risk management guidelines are then combined with the preferred strategy solutions to form implementation recommendations and obtain strategy implementation plans. Conduct feasibility analysis and cost-benefit evaluation on the strategy implementation plan, evaluate the implementation effect, obtain a strategy evaluation report, and optimize and adjust the management strategy based on the strategy evaluation report to generate risk management strategy recommendations.

8. An artificial intelligence-based financial transaction anomaly detection and risk assessment device, used to implement the artificial intelligence-based financial transaction anomaly detection and risk assessment method as described in any one of claims 1 to 7, characterized in that: The artificial intelligence-based financial transaction anomaly detection and risk assessment device includes: A processing module is used to collect and preprocess multi-source financial transaction-related data to obtain a multi-dimensional transaction data set; An identification module, used to perform feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain abnormal transaction recognition results; A construction module, used to construct a financial field knowledge graph based on the abnormal transaction identification result and the multi-dimensional transaction data, and obtain a relationship network between transaction entities; An assessment module, used to perform multi-dimensional risk assessment on the relationship network between the transaction entities to obtain risk scores and risk description data; An analysis module, configured to perform time series analysis and trend extrapolation on the risk description data based on the risk score to obtain a dynamic risk warning signal; The simulation module is used to perform scenario simulation and multi-factor analysis on the dynamic risk warning signal to obtain risk management strategy recommendations.

Images